Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex
Summary: Cisco released patches for CVE-2026-20045, a critical vulnerability with a CVSS score of 8.2 in Unified CM, CM SME, CM IM&P, Webex Calling Dedicated Instance, and Unity Connection that it says has been actively exploited as a zero-day. Cisco attributed the flaw to improper validation of user-supplied input in HTTP requests, allowing an unauthenticated remote attacker to send crafted requests to the web-based management interface, gain user-level access, and elevate to root; CISA added it to the KEV catalog with a February 11, 2026 fix deadline for FCEB agencies.
What you should know: An unauthenticated attacker can reach root on internet-facing communications infrastructure with no workaround available, and CISA's February 11, 2026 deadline signals exploitation is already underway. The flaw follows less than a week after Cisco patched CVE-2025-20393, a CVSS 10.0 flaw in Secure Email Gateway and Secure Email and Web Manager that was also actively exploited.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-20393CVE-2026-20045
- Related
- Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances Cyber Risks ·CVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerability Known Exploited Vulnerabilities · Jan 21, 2026